PCNSA Securing Traffic Practice Question
A security administrator at a hospital needs to allow clinicians to access a cloud-based electronic health record (EHR) system at ehr.example.com. The firewall must inspect the traffic for threats, but the EHR vendor requires that the firewall not decrypt the traffic due to strict patient data privacy regulations. Which Security policy rule configuration should the administrator implement?
⚠ Common exam trap
The trap here is assuming that a Security policy rule can directly control decryption or that URL filtering can exempt specific sites from decryption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Decryption policy rule that matches the destination ehr.example.com and sets the action to no-decrypt, and create a Security policy rule that allows the application ssl and attaches the appropriate Security profiles.
The correct solution uses a Decryption policy rule with the no-decrypt action to exempt ehr.example.com from SSL decryption, honoring the privacy requirement. A separate Security policy rule allows the application ssl and applies Security profiles, ensuring threat inspection still occurs on the encrypted traffic. This two-policy approach is the standard method to selectively bypass decryption while maintaining security enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a Decryption policy rule that matches the destination ehr.example.com and sets the action to no-decrypt, and create a Security policy rule that allows the application ssl and attaches the appropriate Security profiles.
Why this is correct
This correctly uses a Decryption policy rule with the no-decrypt action to exempt the EHR traffic from SSL decryption, satisfying the vendor's privacy requirement. The Security policy rule then allows the application ssl and applies Security profiles such as Vulnerability Protection and Antivirus to inspect the traffic for threats without decrypting it, providing both access and protection.
- ✗
Create a Decryption policy rule that matches the destination ehr.example.com and sets the action to decrypt, and create a Security policy rule that allows the application ssl without any Security profiles.
Why it's wrong here
Setting the Decryption policy action to decrypt would violate the vendor's requirement to not decrypt traffic to the EHR system. Additionally, omitting Security profiles from the Security policy rule means no threat inspection occurs, which contradicts the need to inspect for threats. This combination fails both the privacy and security requirements.
- ✗
Create a Security policy rule that allows the application ssl, with the action allow, and attach a Decryption profile set to no-decrypt for the EHR server certificate.
Why it's wrong here
Decryption profiles are attached to Decryption policy rules, not to Security policy rules. A Security policy rule cannot directly contain a decryption profile setting. The administrator must configure a separate Decryption policy rule to control decryption behavior for this traffic, making this approach technically invalid.
- ✗
Create a Security policy rule that allows the application ssl, with the action allow, and attach a URL Filtering profile that blocks the healthcare category.
Why it's wrong here
Using the ssl application and blocking the healthcare category would prevent access to the EHR system entirely, which is the opposite of the requirement. The scenario requires allowing access while inspecting for threats, not blocking it. URL filtering cannot selectively exempt a specific host from decryption; decryption is controlled by the Decryption policy, not by URL filtering actions.
Go deeper
Related to this question
About these practice questions
One of 385 original PCNSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Palo Alto Networks exam blueprint
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.